allow subdomain restrictions